Every month I do a review of the accounts of our high risk customer. When I first got here, they had no high risk customers. Since I have arrived, when I would file a SAR on someone, I will bump them up to high risk and monitor monthly. I started printing off the account history for that month, go through and make notes on the paper and then put the date and initial that I did the review and note any findings on there. This month I have about 200 pages of account history total (12 high risk customers).

I would like to not print these anymore, but would still like evidence that this is done. Do you think that having a form with the customer name, account numbers that were monitored, the date range looked at, and any findings for that time period would suffice with examiners? What else do you suggest adding to this and/or do you see potential flaws with changing to this method? I don't think I would be the first person to want to reduce the paper that is printed off so I am curious how others are doing this. Thanks!

That sounds almost identical to a process that I started upon moving to the BSA Dept. at my organization as far as bumping up once a SAR has been filed.

Is there a way to take the account history that you're currently printing out and save it to the computer rather than print it? That way, you could make a folder called "high risk review" or something of that nature, and still keep all the docs that you're using but have it an a "greener" fashion. Also, is there a way to limit the range of account history you're going through for each customer? Not sure of the size of you FI/the amount of activity that these customers conduct, but 200 pages for 12 customers sounds like an awful lot; maybe downsize the date range of the history?

As far as your proposal goes, I would recommend that if you're to change it, document the reason for change in memo form; doing this will show the examiners what you did and why you did it. I've documented everything I've changed very thoroughly and during my most recent exam one of the examiners told me that I essentially took hours of work & questions out of their hands by doing this. I can't really comment as to whether or not it would suffice with examiners because I'm not one and certainly don't want to speak on their behalf, but as long as your monitoring the high risk customers and have a documented reason as to why you're doing it I don't see what problem could arise.

We simply print out the high risk list from our automated BSA/AML program on a monthly basis to show the changes in customers that are added/removed from the list, and then we go into their profiles within the BSA/AML program and makes notes on their customer record as to why the change happened, which serves as our documentation of review. Had an exam last month, everyone seemed to be okay with it.

The account history on our system usually only goes back for the current quarter then gets archived. I usually just select the account activity from the month that I am reviewing and only print that selection, unless its only a page anyways.

Printing wasn't bad until the last two months when I moved a convenience store to the high risk category. They have a tremendous amount of transactions on a daily basis, and was probably 1/4 of the paper. I will be sure to document the process for the change. I did find a way to export the account history, so I may go that route and just add notes to the end of it.

We do not currently have any BSA software, so it is a manual process. Our core has some BSA alerts/reports that can be used but they were not set up when they converted in 2012 (don't ask me why). I really need to try and see if I can get that set up correctly, but I also would have to have time to do so. Our core product is set to sunset in the next three years, so hopefully we can get management to upgrade early and properly set it up with the new system.

Thanks for your input PrimeTime.

We are on a manual system. I place my copies of statements and checks in folder set up for the particular customer/business that I review. Also for high risk customers, I review every 90 days instead of monthly. The regulators have had no problem with this. When I find suspicious activity on account review I print the statements and write comments on the statements and then save it to the folder. I know this might be defeating your purpose of reducing but the regulators have commented to me they like this because it shows that I did review the statements. They say they have seen other banks have the statements and never show proof they did a review.

We keep all supporting docs for reviews electronically.

The only hard copy kept, is the risk assessment form itself which is kept in an individual folder for each customer.

Our filing cabinets were getting filled to the brim with overstuffed folders.

And a question for the OP, why are you conducting monthly reviews?

We conduct annual EDD on our high risk customers and our regulators are more than ok with that. We actually used to do it every 6 months but it was too taxing on the staff.

And a question for the OP, why are you conducting monthly reviews?

If I waited a year to do the reviews of the accounts it would probably take me six months because we do not have any BSA software. Also, I am the Compliance Officer, BSA Officer, in charge of Vender Management, do some internal audits (most of them because the internal auditor is nearing retirement and has tuned out completely). If I hit each customers account monthly, I can catch most things and it doesn't take much time this way.

I know I cannot adequately perform all of these responsibilities. A lot of things weren't being done before I got here so I took it on before our last exam so we could try to get through with minimal damage.

Ugh I feel for you then.

Going automated is the way to go, but it also depends on asset size and all that.

I would love to but management doesn't want to spend any money on BSA because we only have good customers. Sigh.

If the activity has never repeated, why are you still monitoring these customers monthly? If it would repeat, I assume that your normal monitoring processes would catch them just like the first time.

You are wasting your time after the first 90 days review for a repeat SAR filing if the activity has quit.